Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pavel Durov listed in leaked Pegasus project data

theguardian.com

Post reply on HN
Print view View original

11–20 of 54 posts

Re: Pavel Durov listed in leaked Pegasus project data

#11

Post by underseacables »

boomboomsubban wrote: post #8
underseacables wrote: post #3

I’m bothered by this Pegasus thing, does anyone have a link to the raw data? I don’t like getting an interpretation of something through the news media anymore. Rather, I don’t trust the news media to provide an accurate or even an honest analysis, and from what I can tell the Pegasus data as it’s called, seems to be something that only the media has access to.

There are security and privacy reasons not to publicly dump leaks like this, and the distrust of the media should be somewhat offset by multiple outlets analyzing the data separately. That said, I'm unsure how the media could twist "x country spied on y individual." Knowing the types of people being spied on, it should be assumed most people of similar importance are being spied on by someone.

I take your point, but what echoes in my mind is when the Hillary emails were leaked, and people like van Jones were saying no you’re not allowed to look at that, but we the media, we are allowed to look at that. They could redact information, but I lament that my trust in the media is so low that I cannot fully trust it without seeing the raw data myself. Even having that raw data available would give me more confidence in the reporting.

Re: Pavel Durov listed in leaked Pegasus project data

#12

Post by tester34 »

djanogo wrote: post #5
shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

He pivoted the NSO group targeting to Apple-Google discussion, with out any proof that Apple had anything to do with Pegasus. He wants biggest American companies that world has ever had to open source and loose all the edge against rest of the world, but he runs close source proprietary server software which he wants people to use for secure communication.

>He wants biggest American companies that world has ever had to open source and loose all the edge against rest of the world

if software is the edge, then it's not solid, imo.

I thought US edge was capital, skilled people who can create insane stuff quickly and engineering culture that enables them

Re: Pavel Durov listed in leaked Pegasus project data

#13

Post by holmesworcester »

djanogo wrote: post #5
shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

He pivoted the NSO group targeting to Apple-Google discussion, with out any proof that Apple had anything to do with Pegasus. He wants biggest American companies that world has ever had to open source and loose all the edge against rest of the world, but he runs close source proprietary server software which he wants people to use for secure communication.

> with out (sic) any proof that Apple had anything to do with Pegasus.

Um, bundling a messaging app that parses feature-rich messages sent from anyone in the world using a memory-unsafe language and abusing DRM laws intended for anti-piracy protection to *ensure that no one can uninstall it from their phone* doesn't count as proof that Apple had something to do with Pegasus?

Yes, Durov's assertion that the bugs NSO exploited were intentionally left there by Apple at the behest of US intelligence agencies is presented without proof, and while conceivable is very unlikely [1].

But his assertion that monopoly practices by Apple had something to do with the Pegasus hacks is perfectly accurate given that Messages is insecure, forcibly bundled, and was in fact how many journalists and human rights defenders were hacked.

Durov's point that "it doesn't matter what apps you have installed on your phone" is especially depressing and a direct result of Apple's use of DRM to prevent users from uninstalling Messages. It would be nice if people could install Messages from their iPhones right now. Thanks to Apple, they can't.

[1] Not because Apple wouldn't do it if pressured (we know, for instance, that they caved to such pressure on iCloud encryption) but merely because there are likely so many vulnerabilities to find that the chances NSA, Apple, and NSO were all aware of the same vulnerabilities are very low.

Re: Pavel Durov listed in leaked Pegasus project data

#14

Post by boomboomsubban »

underseacables wrote: post #11
boomboomsubban wrote: post #8

Earlier quoted context omitted.

There are security and privacy reasons not to publicly dump leaks like this, and the distrust of the media should be somewhat offset by multiple outlets analyzing the data separately. That said, I'm unsure how the media could twist "x country spied on y individual." Knowing the types of people being spied on, it should be assumed most people of similar importance are being spied on by someone.

I take your point, but what echoes in my mind is when the Hillary emails were leaked, and people like van Jones were saying no you’re not allowed to look at that, but we the media, we are allowed to look at that. They could redact information, but I lament that my trust in the media is so low that I cannot fully trust it without seeing the raw data myself. Even having that raw data available would give me more confid…

If you had access to the data, how would you verify that Durov's number was listed? Then what confidence would that give you? Trusting an anonymous leak more than the media who vetted the data seems misguided.

Re: Pavel Durov listed in leaked Pegasus project data

#15

Post by coolspot »

djanogo wrote: post #5
shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

He pivoted the NSO group targeting to Apple-Google discussion, with out any proof that Apple had anything to do with Pegasus. He wants biggest American companies that world has ever had to open source and loose all the edge against rest of the world, but he runs close source proprietary server software which he wants people to use for secure communication.

Apple is known to hand off whole China iCloud to CCP.

Also they refuse to zero-knowledge (e2e) encrypt US iCloud backups[1].

In San Bernandino shooter’s case, they refused FBI’s request to develop new tools to hack an already locked iPhone.

However I have little doubt they will refuse to sign&push OTA update of a Signal.app or “improved” iOS developed and provided by NSA.

Mercenary who helped Carlos Ghosn, recalled that in the middle of operation, while riding a train, his iPhone suddenly rebooted and started an iOS update[2]:

--

On the train, Taylor’s phone began an unexpected automatic software update. “The first thing I thought was, I wonder if the NSA knows,” he recalls. “I wouldn’t put anything past them.”

--

[1] - https://blog.elcomsoft.com/2021/01/apple-scraps-end-to-end-e...

[2] - https://www.vanityfair.com/news/2020/07/how-carlos-ghosn-esc...

Re: Pavel Durov listed in leaked Pegasus project data

#16

Post by Y_Y »

fsflover wrote: post #7
shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

I love my PinePhone but I can't run WhatsApp on it. I suppose I could use an emulator, but it's slow enough already.

Re: Pavel Durov listed in leaked Pegasus project data

#17

Post by fsflover »

Y_Y wrote: post #16
fsflover wrote: post #7

Earlier quoted context omitted.

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

I love my PinePhone but I can't run WhatsApp on it. I suppose I could use an emulator, but it's slow enough already.

This is a typical problem with the proprietary apps: they can dictate you how you must run them. Not a fault of Pinephone. By the way, Librem 5 is significantly faster.

Re: Pavel Durov listed in leaked Pegasus project data

#18

Post by zeropoint46 »

fsflover wrote: post #7
shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

Just curious if maybe you or anyone else knows. Are alternatives OS's such as lineage, postmarketOS, copperheadOS, etc. safe from this exploit?

Re: Pavel Durov listed in leaked Pegasus project data

#19

Post by csydas »

shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

>> Personally, I wasn't worried: since 2011, when I was still living in Russia, I’ve got used to assuming that all my phones were compromised.

I know it's fun to slam on Telegram (and for sure its encryption has flaws, I really don't think anyone denies this), but everyone needs to understand the mindset of Durov and what I'm guessing is the mindset of russian-born telegram developers: your phone can be compromised, and easily at that.

I think this is something very important for everyone to remember when the discussion of encryption and messaging comes up.

The level of encryption in transit doesn't matter if your adversary has full access on your phone that can just screenshot and pull local messages of whatever they want.

NSO's ridiculousness hopefully has made it very clear that it doesn't matter which phone/OS you're using; full access to your phone is a salable item for basically anyone with the interest in having it, and this is only the software we know about.

Journalisst, Activists, or even just someone looking for a fun weekend is at risk with modern phones and messaging; it does not matter about tapping the communication in-between if they can just screenshot/copy your phone on the fly.

Be careful about what you use your phone for.

Re: Pavel Durov listed in leaked Pegasus project data

#20

Post by klyrs »

igorzx31 wrote: post #10
underseacables wrote: post #3

I’m bothered by this Pegasus thing, does anyone have a link to the raw data? I don’t like getting an interpretation of something through the news media anymore. Rather, I don’t trust the news media to provide an accurate or even an honest analysis, and from what I can tell the Pegasus data as it’s called, seems to be something that only the media has access to.

The indications are on github if you want to check your phone.

https://github.com/AmnestyTech/investigations/tree/master/20...
Post reply on HN